612409 matches found
GHSA-C2RV-HWQM-WJPG vulnerabilities
Vulnerabilities for packages: opensearch...
Malicious code in array-sort-helper (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c18cc0d6d922eb6bbfcb565415772dbd0bb246ca7595f18afe1f87f2f6c1a33 The npm postinstall script in [email protected] automatically runs on npm install and executes a shell reconnaissance and exfiltration routine...
MAL-2026-11118 Malicious code in array-sort-helper (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c18cc0d6d922eb6bbfcb565415772dbd0bb246ca7595f18afe1f87f2f6c1a33 The npm postinstall script in [email protected] automatically runs on npm install and executes a shell reconnaissance and exfiltration routine...
Malicious code in json-to-table-util (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2317bf7f973ca611fdd2215509ae94c302f868ae9fb5c5f00de0b6bd13fe3bc4 postinstall.js runs automatically on npm install and executes a shell pipeline via childprocess.exec that collects hostname, user, working directory,...
MAL-2026-11119 Malicious code in json-to-table-util (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2317bf7f973ca611fdd2215509ae94c302f868ae9fb5c5f00de0b6bd13fe3bc4 postinstall.js runs automatically on npm install and executes a shell pipeline via childprocess.exec that collects hostname, user, working directory,...
MAL-2026-11107 Malicious code in num-format-helper (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04a0ecb436de3a0e93a577a3ba1733b227bd536e02acf371df530c6a320e1001 Package advertises itself as a number/locale formatting helper but its postinstall.js runs automatically on npm install and shells out via...
MAL-2026-11106 Malicious code in date-sanitize-helper (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33b6764b7711cfa03cf6b3a2f70e24b3256a61ac9319d45200ada236fe7c3ed2 The package is advertised as a date parsing/sanitization helper but its postinstall.js runs automatically on npm install and performs installer-side...
Malicious code in string-format-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e41e5ec29fcbb379f86d5a6167b42aec242fede681343996c198b1430e2dffa The package's postinstall.js lifecycle script executes a shell pipeline via childprocess.exec on npm install. The pipeline reads /.ssh/idrsa,...
MAL-2026-11108 Malicious code in string-format-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e41e5ec29fcbb379f86d5a6167b42aec242fede681343996c198b1430e2dffa The package's postinstall.js lifecycle script executes a shell pipeline via childprocess.exec on npm install. The pipeline reads /.ssh/idrsa,...
Critical: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: erlang27: erlang27-27.3.4.15-0.1.hum1 aarch64, x8664 erlang27-asn1-27.3.4.15-0.1.hum1 aarch64, x8664 erlang27-commontest-27.3.4.15-0.1.hum1 aarch64, x8664 erlang27-compiler-27.3.4.15-0.1.hum1...
[SECURITY] Fedora 43 Update: rpm-6.0.2-1.fc43
The RPM Package Manager RPM is a powerful command line driven package management system capable of installing, uninstalling, verifying, querying, and updating software packages. Each software package consists of an archive of files along with information about the package like its version, a...
[SECURITY] Fedora 44 Update: rpm-6.0.2-1.fc44
The RPM Package Manager RPM is a powerful command line driven package management system capable of installing, uninstalling, verifying, querying, and updating software packages. Each software package consists of an archive of files along with information about the package like its version, a...
Malicious code in @vaultflow/update-flow (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 031c8cb2cc9eb21371fdd4a9a9d6949857fd978868e3dfd8f5d126e95a6a5780 index.js is a verbatim copy of the feross/buffer module with a single injected top-level statement var ins = import'@vaultflow/create-flow' that...
MAL-2026-11097 Malicious code in @vaultflow/update-flow (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 031c8cb2cc9eb21371fdd4a9a9d6949857fd978868e3dfd8f5d126e95a6a5780 index.js is a verbatim copy of the feross/buffer module with a single injected top-level statement var ins = import'@vaultflow/create-flow' that...
Malicious code in @vaultflow/create-flow (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 427ce4e703502549a51bc970efc1001b50680261cf55483c4eb1ac7569f61d48 On require/import, the package's main module performs an HTTPS fetch to https://api.github.com/gists/198a0bbec7a6018e9250615d26e37b90 a gist owned by...
MAL-2026-11096 Malicious code in @vaultflow/create-flow (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 427ce4e703502549a51bc970efc1001b50680261cf55483c4eb1ac7569f61d48 On require/import, the package's main module performs an HTTPS fetch to https://api.github.com/gists/198a0bbec7a6018e9250615d26e37b90 a gist owned by...
RHEL 8 : libpq (RHSA-2026:47090)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:47090 advisory. The libpq package provides the PostgreSQL client library, which allows client programs to connect to PostgreSQL servers. Security Fixes: postgresql:...
OPENSUSE-SU-2026:11400-1 tomcat10-10.1.57-1.1 on GA media
These are all security issues fixed in the tomcat10-10.1.57-1.1 package on the GA media of openSUSE Tumbleweed...
MAL-2026-11101 Malicious code in motion-forge-css (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f9c883a4865db328dff8b43c279a353b6ad494416a665e0201fdca7b6ba4daa Package advertises itself as a small PostCSS vendor-prefix / CSS-variable-injection plugin but ships a single 105KB obfuscator.io-packed bundle as it...
Malicious code in motion-forge-css (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f9c883a4865db328dff8b43c279a353b6ad494416a665e0201fdca7b6ba4daa Package advertises itself as a small PostCSS vendor-prefix / CSS-variable-injection plugin but ships a single 105KB obfuscator.io-packed bundle as it...